This vulnerability is a type confusion flaw in .NET and Visual Studio that permits an unauthorized attacker to elevate privileges over a network. By accessing resources with an incompatible type, the attacker can execute code with higher privileges, potentially compromising system integrity and confidentiality. The weakness is identified as CWE-843.

Affected systems include Microsoft .NET Framework versions 3.5 through 4.8.1 and Microsoft Visual Studio 2022 (v17.14) and 2026 (v18.10).

The CVSS score of 8.8 indicates high severity. While the EPSS score is not available, the lack of a KEV listing suggests no confirmed widespread exploitation yet. Based on the description, the likely attack vector is a network-based privilege escalation where an attacker can exploit type confusion to gain higher privileges. The vulnerability does not require local privileges or user interaction, broadening the potential threat surface.